����݁��Y��}%}��@Iʧ���3�Q+Y�Es��e�� �lTуAȯ� ���tZ7�/�m�E�[�>�D%y������Ѝ��:�)wǍ��s�D�g*yLޏ�^��]1�8�,�m��m���c1N�b�}J��)����Z/�� 3�vSCBa��lH5�4�$;~�6�wC+���%��0N�3�FFw�3��_vZ�̄��e�IO|"��[NގMD�1��i 1�x:�a��fg��d�G=�ǣp��j2 �ۀ>g>�q�%������ԁ��z!V�-�;bQ���c-�Ș��@[��S ȴO�3�t��U8�?��"�@X`�̕ߞYS�i��*d��n-!�&����;���c�8]�Gn�������te����$����WW�e�����"=�>��o����:rbܥ����{j@/�Q+8�x糊������e���b�w�$���OE��ϟ�����J�'"9w[��*� _ ��=���������Q��*}h6�����%P�Ś+ƀ�]"z���\�J ^q,+�$p�r3��h�6��5KA��t� �8̇N����k�����Im�`%�i~�����)�b�%p ��.��}<���dlWJ�[J��Њ1�� ��9(�.�IZA�/3��Rb����G��[|���Ҋ��0�LUY��Ԭ�o�s��a���3|/��ɀ���4�qL���呼�X��f��͢q�C/Ļ5�\���e�V(��@�L��"X�k���7���'E�_sg4l����>�V��y����B�e(�% j�P �^��0BʊޕJi��!�*&��I�Á�]���y���QV2�\Ff.����eC�k�&V'�S� �=r�0G���u�dƀ�_��6�dڀ����R�ZQ�. �NpR�^Y��Ǫ�D'#�C ���ȍLc1��ji̶�{.��8��X�_K�,8��^n�`�FL�?i�ߎ'�Yb��� ��tVɏ�&!�(�MI����X�|/F˩��bh�uY��p��%& �J��N6���+C۠<|C"���D?�yз��c�O��� ]�t�-�6_�oۭ�bM������D��}�ό�nF�M4��P -,f�c*2����2çq��I0�0�P���3Ƭ��͝'��iB�c~����GE� �t��R];&�I�8�6�����r�Waq���������R�t��4p��V�H��O^��u�.?~���� ~B�П�/����k�R�8�h���o�Me�]cqR��D�>,8�ʡ����h['�S��e������/|������d����^�snE��_221��W�[N� �\�Dz�a��BпO�م��q���e���H�mĵX��>̲)�� D��sF���A>P���J?�z�r1���h�q�==����v0�]����*�A `�3d��4C�]����/y �а�U,�v[k��Hӥdr�<y���8�Ն#���Gg;��U*g�����Q<���{�/����&�tTcчJ��c�e�y�/�_��6��☊��!* iT)z�᳛�,�yN)c��0m���zR��2�/!8���+P��D]�!+4��ӆX�;�]a����wn� l/�Z`���v{Xy��r�ZOv���3h��l�$jt���B� �?�锡F~���|ݞ ���9u���I��X�#�2�3L4�}�t�؛��� iaM��"x�"rD(�J��(t�y��x�cr����?�sHHz������ۜ����8�=?MIW�>�=c�������q����^_Nf:���}rf��<㾫#`��y�S���7XH��[gTO�'oO��9`��G|�y �0r���A��^NZ+K�?�� �뿂�1��`rbq���Lf/[�VQ�5�>��ak+y�+�F��d6� I�%���z��L�����������<+l1S�]V ��ޕ�3��ᥜ�����ް3�s$�pqwh�)YO��a/�Q)X�W�]���<C�Z .����P�Bd�r+� %+��?q�څb����;(�|.��^I֊��S��2�A7��`!/��R � ����" E����6W�gKy�Մ�v8���TN�ER�瀝e/=h��+j�c����#/I��Ґ��6#RY�O����a5}~�b�k`�'���Mw}`�]S��$: �����;��������W"S�Fia �|���з���D[�x2ُ,Ve�v�m>s)��ɥ��m��;,�4ݬ6�4l]3?��L�)T�NЅb�Ṯ)x�C���� ���E�������rF��J\�O5��|#.�b���G�J�Z�-���*���:�M�T!�K���(p�̴nT�6*3�� �+/[�E\�l�m/�N��% �*|�r�Ԡ8� 4t���~sf���)�؞S�sI�%��;E�8Ai%��|ő� ��� A�]}��8q˄:��n�R�c{�B|v'e�)H��y���"�(c�P�r��#��o��b�͂P��AQɉ�Ф�����-^"h윈_+=�;1����z;I������x�X�-*�)'��<�/�q�o�H�ufφ�k��O���#���3h�α=�~�D�5�S^�����.�N)ڋ(^��t�f�����ܣ �<���$�Yt��:��-z��=w��x���.��d�~�q9?����v �0�jfm������@�b�j�Jv�=��U�9���Vfp�4i :�l.�&dmuԜ� ����%+��`��m�v�����/Q���7f-g/)���u�`5��,�m��˶ [��N�[y��`����L����Z��#��k�a���p�*���;���4�2���0�(������ڄ-4̭�� w��v��%�EX���Ñ�?iK�k�^r"Tg+�m-BKtWG�d����{_�Jo��imX���tn����M��gCP�(��c���cU����ޕK�o�V�>Jn��q��}<Z5KB���Ŏ~sݞVf������y��� Ӭ��- �ւH�<�O��H'�wU\��)q����O�1��_~�Izs+���?Ņ�kBR�+V8�H���"��E�����/M8�]�Ϗ�c�z�[���Z��ݒ�q���Μ��⥦���Q�P�o�|��-)b�t�@��3��te>O���Tj =��+�[ae"���X3�̎O�"�?��mgF�QtT� W�C�6��+�&\�PȺ��l��#���Mc��zu% �O@Ě�/:e��V!s/դ?�*��VБҋj��,�o��@��؏D��'ͨ�T��qF�w�������| ����I�k �wF%}��"����A�_y&�����=�d� L��D�.�q�d�������}�&���d��)'��P��B�3�Ǚ�N|},x],�����P&����>���XݰpJ���%.�.�1�m��Q�f�En�M�l4���c[�0T6�2n�R0�� ,���k�:\ŵ���M(p`C�*��Q�p���] I+���H��I���v�SEO��u^��(�$�"��gD׀t�����A���� AB��I!k�c�� �'<��=]�6���z��쩲ɀ��e )�����` \����^�YW��SND��+JX推 ��P^�^l�g�� ���T��7�=�Ů�9~V��r�yW(�aߐǀ��dd����r�W��f�Z<��1�M s4��]��k��pܡsջ$���!��X��q��
Static task
static1
Behavioral task
behavioral1
Sample
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe
Resource
win10v2004-20240226-en
General
-
Target
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c
-
Size
2.5MB
-
MD5
e49ba2b2c27a164cf3b652069fc984c2
-
SHA1
1a6c7d91286220e2c28a665f85633825ef578e95
-
SHA256
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c
-
SHA512
2c4336dc6e062483753d760c339fb4bd7e6e06dfc5b9b25d4b05885414a9b7a5b9c62931558c31f1f398862c111ad35c6389c1ee3af15af2d2cbc3db85ecc670
-
SSDEEP
49152:+L2K7HrOi1eIhFwRncwD0FnPYAEhd/KOw8QwsJM60lQYJnn3Ect76:wd7Hrhh2RcYonAJ6BM667nnRt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c
Files
-
8ae3fd7c63fdc8bd79ab0890edd553d701482b7e90910b0eaa7e32f28b867e5c.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 225KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE